Skip to content

CPP: Support crement operations in CWE-190 #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jbj merged 8 commits into from
Aug 29, 2018
Merged

CPP: Support crement operations in CWE-190 #105

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
d2fd986
CPP: Support crement operations in CWE-190.
geoffw0 Aug 23, 2018
a125e3e
CPP: Fix crement operations on pointers.
geoffw0 Aug 23, 2018
87fb447
CPP: Improve the logic in ArithmeticWithExtremeValues.ql.
geoffw0 Aug 23, 2018
eaf4c6e
CPP: Change notes.
geoffw0 Aug 24, 2018
0bd8d9a
CPP: Spell out increment / decrement in change note.
geoffw0 Aug 28, 2018
229d040
CPP: Add support for += and -=.
geoffw0 Aug 28, 2018
c82ab38
CPP: Extend change note.
geoffw0 Aug 28, 2018
0d63739
CPP: De-conflate cause and effect strings.
geoffw0 Aug 28, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
CPP: De-conflate cause and effect strings.
  • Loading branch information
@geoffw0
geoffw0 committed Aug 28, 2018
commit 0d6373924c5f359c665e4f57e1fe21fdec4ed2ca
21 changes: 16 additions & 5 deletions cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,8 @@ predicate isMinValue(MacroInvocationExpr mie) {

class SecurityOptionsArith extends SecurityOptions {
override predicate isUserInput(Expr expr, string cause) {
(isMaxValue(expr) and cause = "overflow") or
(isMinValue(expr) and cause = "underflow")
(isMaxValue(expr) and cause = "max value") or
(isMinValue(expr) and cause = "min value")
}
}

Expand All @@ -45,13 +45,24 @@ predicate taintedVarAccess(Expr origin, VariableAccess va, string cause) {
tainted(origin, va)
}

from Expr origin, Operation op, VariableAccess va, string effect
where taintedVarAccess(origin, va, effect)
predicate causeEffectCorrespond(string cause, string effect) {
(
cause = "max value" and
effect = "overflow"
) or (
cause = "min value" and
effect = "underflow"
)
}

from Expr origin, Operation op, VariableAccess va, string cause, string effect
where taintedVarAccess(origin, va, cause)
and op.getAnOperand() = va
and
(
(missingGuardAgainstUnderflow(op, va) and effect = "underflow") or
(missingGuardAgainstOverflow(op, va) and effect = "overflow")
)
) and
causeEffectCorrespond(cause, effect)
select va, "$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".",
origin, "Extreme value"